CVE-2026-34177

The isVMLowLevelOptionForbidden function in lxd/project/limits/permissions.go does not include raw.apparmor and raw.qemu.conf keys in the list of options blocked by the restricted.virtual-machines.lowlevel=block restriction. An attacker with can_edit permission on a VM instance in a restricted project can inject custom AppArmor rules and QEMU chardev configuration that creates a bridge between the LXD Unix socket and the guest machine. The access obtained to the LXD socket enables issuing commands with cluster administrator privilege level, ultimately leading to root escalation on the host.

An attacker can obtain full administrator privileges of the LXD cluster and subsequently take control of the host system with root privileges, resulting in complete infrastructure compromise.

Apply patches available from the vendor according to references (pull request #17909 in canonical/lxd repository and advisory GHSA-fm2x-c5qw-4h6f). An upgrade to version higher than 6.7 is recommended. Temporarily, consider restricting can_edit permissions on VM instances in projects with lowlevel=block restriction enabled.

Canonical LXD in versions 4.12 through 6.7 inclusive, when configured with restricted.virtual-machines.lowlevel=block restriction in projects with virtual machines.